2026-08-24_ac85f506687c06109c5bb68d12953018_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_ac85f506687c06109c5bb68d12953018_cobalt-strike_icedid_njrat_satacom_stealc
Size 184KB
Sample260825-e5fg1awhkd
SHA256 b3babc0ec60f68c3e63219fcbe8c69fc5e6e6aa8ffce531168bd0fd71d1f933d
MD5 ac85f506687c06109c5bb68d12953018
SHA1 7d66a290092bc50ea012a3d6af8b94e81aa49c47
SHA512 9b4330d1a7b1d644fc2207eb19c6e35cb16bd241f1fb4b6e5d28164cb680df3dc2bf4144c4c994d21a4e7442410fa11d64b35252dbca9b7bbaf367564e373800
SSDEEP 3072:XpHKce4VvONvtQCXfPBMSC/cbULPbTVmy3HlpQVbU0QW:XpHKcVcHRJKcoTg4oe
TLSH
T179047D15FBA940FAE1778538C9520A01FA737C510760AADF17904AB6DF236D4AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_ac85f506687c06109c5bb68d12953018_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-24_ac85f506687c06109c5bb68d12953018_cobalt-strike_icedid_njrat_satacom_stealc

.exe 184KB

2026-08-24_ac85f506687c06109c5bb68d12953018_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH e6f2d2642a93eecc748b82a56fc2837d
SHA256 b3babc0ec60f68c3e63219fcbe8c69fc5e6e6aa8ffce531168bd0fd71d1f933d
MD5 ac85f506687c06109c5bb68d12953018
SHA1 7d66a290092bc50ea012a3d6af8b94e81aa49c47
SHA512 9b4330d1a7b1d644fc2207eb19c6e35cb16bd241f1fb4b6e5d28164cb680df3dc2bf4144c4c994d21a4e7442410fa11d64b35252dbca9b7bbaf367564e373800
SSDEEP 3072:XpHKce4VvONvtQCXfPBMSC/cbULPbTVmy3HlpQVbU0QW:XpHKcVcHRJKcoTg4oe
TLSH
T179047D15FBA940FAE1778538C9520A01FA737C510760AADF17904AB6DF236D4AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

LoadCursorW FillRect GetClientRect InvalidateRect EndPaint BeginPaint UpdateWindow GetSystemMetrics GetKeyState IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW MessageBoxW

gdi32

TextOutW TextOutA MoveToEx SetTextColor SetBkMode SelectObject CreateFontW CreatePen CreateSolidBrush DeleteObject GetStockObject GetTextExtentPoint32A LineTo Rectangle

shell32

ShellExecuteW

advapi32

RegQueryValueExW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW CreateServiceW ControlService CloseServiceHandle AllocateAndInitializeSid RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCloseKey GetUserNameA FreeSid CheckTokenMembership

kernel32

WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW MultiByteToWideChar WriteConsoleW GetCommandLineW GetCommandLineA SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap CreateFileW GetFileAttributesW CloseHandle GetLastError Sleep TerminateProcess CreateThread CreateProcessW OpenProcess GetWindowsDirectoryW GetModuleFileNameW GlobalUnlock GlobalLock CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCPInfo GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetOEMCP QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

wininet

HttpOpenRequestA InternetReadFile InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA HttpSendRequestA

Name

.text

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_ac85f506687c06109c5bb68d12953018_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

shell32

advapi32

kernel32

wininet

generic